As some of the challenges from these models stem from their open-ended nature, we should develop ways to more effectively explore the input and output space of their models, so as to discover harms prior to deployment. We can model this on the ‘red team’ approach which is popular in the computer security industry and can be applied in an AI context [1]}, [2]}. This should take the form of both static benchmarks (for example, adversarial datasets to probe for weaknesses in computer vision systems [3]}), as well as continuous evaluation by humans carrying out multi-step interactions (e.g, conversations [4]}, [5]}) with these models, as well as plans for how to update the models in response to what these evaluations find.
